TL;DR CISA published advisory ICSA-26-272-06 on September 29, 2026, for a critical MikroTik RouterOS vulnerability, CVE-2026-84411. A single crafted HTTP request can give an unauthenticated attack…

TL;DR A JupyterLab Desktop vulnerability, CVE-2026-102530, rated CVSS 9.4, lets a malicious server URL run code on a user’s computer. The app displayed remote server URLs without sanitizing …

TL;DR HPE Networking disclosed 18 HPE Instant ON vulnerabilities on September 29, 2026, in its Instant ON access points. Five are rated Critical, and the two worst score CVSS 9.8 with unauthentica…

TL;DR WatchGuard disclosed 14 Fireware OS vulnerabilities on September 29, 2026, affecting its Firebox firewalls. The worst, CVE-2026-86131, scores CVSS 9.2 and allows remote code execution in cer…

TL;DR Technical details and a working proof-of-concept exploit are now public for CVE-2026-94545, a critical Next.js RCE in the next/og image API. One unauthenticated request can run commands on t…

TL;DR OpenBao maintainers issued security updates to address two critical flaws in the secrets management platform. These OpenBao security vulnerabilities allow attackers to execute arbitrary code…

TL;DR GitLab released AI Gateway versions 19.2.4, 19.3.2, and 19.4.1 to fix CVE-2026-90970. The GitLab AI Gateway vulnerability scores 9.9 on CVSS 3.1. It lets a logged-in Duo Agent Platform user …

TL;DR The Apache Software Foundation disclosed eight CVEs on October 2, 2026, across three projects. The most urgent is an Apache OpenOffice vulnerability, CVE-2026-59265, that runs attacker code …

TL;DR Perforce has patched six P4 Search vulnerabilities in version 2026.4.2. The worst, CVE-2026-100103, scores a perfect 10.0 on CVSS 4.0 and lets an unauthenticated attacker take full control o…

TL;DR AMD has disclosed CVE-2026-43598, an AMD RCCL vulnerability rated 7.7 on CVSS 4.0. The flaw sits in the ROCm Communication Collectives Library and could let a compromised peer run code remot…